Indonesia's Anti-Scam Centre Has 702,000 Reports: Five Anti-Fraud Rules for Shop Staff

The Indonesia Anti-Scam Centre (IASC) received 702,342 fraud reports from the day it began operating, 22 November 2024, to 30 September 2026. Katadata reported the figure on 16 October 2026, based on data from the Financial Services Authority (OJK) and Satgas PASTI, the national task force against illegal financial activity. Of Rp811.1 billion in victims' funds that were blocked, Rp207.16 billion has been returned.

Those reports come from the general public, not specifically from businesses. The methods named, though, are familiar to anyone who runs a shop: fake links, callers posing as bank officers, fake proof of payment. Year end is the busy season, when transactions rise, suppliers send bills and teams work in a hurry. That is when simple working rules earn their keep, and why business scam prevention Indonesia style is worth an hour of a small team's time this week.

The figures as reported

According to Katadata, up to 30 September 2026:

• The IASC received 702,342 fraud reports.
• 702,833 bank accounts were blocked.
• Victims' funds blocked came to Rp811.1 billion. Funds returned came to Rp207.16 billion, from accounts at 24 banks.
• In the same period Satgas PASTI shut down 951 illegal online lenders (known locally as pinjol), 242 illegal investment schemes and 27 illegal pawn operations.

Compare the two figures in the middle. The money returned is roughly a quarter of what was blocked. For a small business the meaning is plain: prevention costs far less than hoping to get money back.

The five methods named in the report:

1. Investment fraud.
2. Phishing through fake links or files.
3. Impersonation of bank officers.
4. Online job vacancy fraud.
5. Online shopping fraud: fake sellers, unrealistic prices, fake proof of payment, payment outside the platform.

Katadata also quoted financial planner Rista Zwestika's advice: separate the account for daily transactions from savings and emergency funds, check statements regularly, switch on transaction notifications, and hold to the principle "stop, check, then act".

Five working rules for a small team

The rules below are our advice, derived from the methods above. They are not OJK instructions. Write them on one page, read them to the whole team and post them near the admin desk.

Rule 1: only named people may transfer money

Decide by name who may send money from the business account and up to what limit. The admin who answers customer chats does not need transfer access. The cashier does not need the banking password.

Above a set amount, require the owner's approval by phone call, not by chat.

Rule 2: two people verify any change to a supplier's bank account

A message such as "our account has changed, please send the next payment to the new number" is a door fraudsters often try. The rule:

• A change of destination account is never accepted from chat or email alone.
• One person phones the supplier on the number you have held for a long time, not the number in that message.
• A second person records the confirmation, and only then is the account detail changed.
• The first payment to the new account is small, then confirmed as received.

The same goes for an "owner" who suddenly messages from a new number asking for an urgent transfer. Call the owner's old number first.

Rule 3: PINs, passwords and one-time codes are shared with no one

This rule has no exception. PINs, passwords and one-time passcodes (OTP) are not given to anyone, including a person claiming to be a bank officer, a marketplace officer, a courier, or a customer who says a code was sent to you by mistake.

Add two habits:

• Links and files from unknown senders are not opened on a device used for banking or store accounts.
• If a caller claims to be from the bank, hang up, then contact the bank on an official number you look up yourself.

Rule 4: a separate operating account

This follows Rista Zwestika's advice. For a business it looks like this:

• One operating account to receive payments and pay daily expenses. Keep the balance modest.
• One reserve account for wages, holiday allowance, tax and contingency. It is not linked to any app staff can use.
• Transaction notifications on for both.
• Statements checked daily by someone who did not make the transactions.

If the operating account is breached, the loss is limited to what sits there.

Rule 5: proof of payment is checked on the shop's side

A screenshot from a buyer is not proof. Goods are shipped or handed over once the money shows in the business's own statement or transaction report. This applies at the till and in chat, and to buyers you already know.

The first hour if you are scammed

Katadata's report gives three steps for victims: contact the bank or financial service provider at once, keep records of transactions and communication, and report to the IASC or the police. For a business we suggest writing the sequence down and posting it, because a person in a panic struggles to think in order.

1. Stop. Send no more money and do not keep talking to the fraudster.
2. Contact your bank or financial service provider immediately. Give the time, the amount and the destination account. Ask for a report number.
3. Secure the evidence: chat screenshots, the sender's number, the transfer slip, any links received. Delete nothing.
4. Change passwords on accounts that may be exposed, starting with banking and email.
5. Report to the IASC or the police with that evidence.
6. Tell the whole team what happened, so the next person is not caught the same way.

Keep your bank's official service number on paper at the admin desk, ready in advance.

What to do this week

• Write the five rules on one page and read them to the team.
• Decide who may transfer money and the limits.
• Check who holds the banking and store account passwords, and change them if too many people know.
• Switch on transaction notifications.
• Post the first-hour sequence at the admin desk.

If your team serves customers over chat, Polynusa offers a shared WhatsApp inbox on the business number that several staff can work, with notes per customer, so an odd request is seen by more than one person.

Sources

• Katadata, 16 October 2026: OJK receives 702,000 fraud reports, how to protect your money

FAQ

How many fraud reports has the IASC received?

According to Katadata, 702,342 reports from its start on 22 November 2024 to 30 September 2026. These are reports from the general public, not specifically from businesses.

Should staff give a one-time code to a bank officer who calls?

No. PINs, passwords and one-time codes are never shared with anyone, including someone claiming to be a bank officer.

What should a business do if it has been scammed?

Contact the bank or financial service provider at once, keep records of the transactions and communication, and report to the IASC or the police.